Skip to content

SupiVPN v0.8.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 26 Oct 18:36
Immutable release. Only release title and notes can be modified.
v0.8.1
994b80d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

SupiVPN v0.8.1

This patch fixes missing readable ownership information in the issued-profile
registry. It preserves existing client profiles and their authorization identity.

Changes since v0.8.0,
from PR #36.
Release commit: 994b80d04d1ec5e04a519002ae34cb34fb009bfa.

Changes

  • Store the verified SAML NameID as issued_profiles.owner_username at profile
    issuance, including browser downloads and one-use OpenVPN Connect imports.
  • Show the owner label in privileged profile list/status output and document the
    corresponding SQL query for Lambda operators.
  • Recover labels for existing profiles from retained, agreeing verified login
    records during migration. When there is no remaining evidence, keep the label
    empty until a successful SAML admission with that profile. Never-used profiles
    and profiles whose login history was pruned remain valid with an empty label.
  • Preserve profile IDs, proof hashes, subject hashes, active/blocked states,
    revisions and creation times. No username is embedded in the client file.

Compatibility

Database schema 12 is required for the updated bound-profile features and all
three isolated Lambda components. Prepare matching binaries and verify backups
before a maintenance window. Quiesce controllers, all three Lambda components
and recovery scheduling; drain VPN pairs if heartbeat continuity cannot be
maintained. Apply migration 012 with the explicit migrator, reapply the
restricted runtime grants, and resume with matching binaries. The public role
gains UPDATE on the owner-label column only; it still cannot update profile
proof, ownership identity, state or revision. Restricted SQL operators need
SELECT on the new column.

Migration 012 scans retained logins and issued profiles and takes DDL locks.
The existing 3-second lock and 10-second statement timeouts apply; a timeout
rolls back the migration. Migration and grants are separate transactions, so a
grant failure must stop the deployment before traffic resumes.

Existing .ovpn files do not need to be reissued. Legacy client migration remains
supported in the 0.8.x and 0.9.x series with the existing explicit two-port setup.
v0.8.0 binaries reject schema 12; mixed old/new Lambda runtimes and database
downgrades are not supported. After migration, runtime rollback requires a
verified schema-12-compatible build. Do not restore stale authorization state.
The updated VM runtime retains schemas 7 through 12 for legacy authorization;
bound-profile features require schema 12.

After upgrade, check profile list/status, a login using an existing bound
profile, and block/reactivate using the current revision.

See schema 11 to 12
and Lambda profile administration.

Boundaries

Owner labels are personal audit data, not authorization evidence. Admission
continues to require the profile proof, matching verified subject hash and active
state. An empty or conflicting historical label does not weaken these checks.
Concurrent row locks may defer filling an empty label to a later login.
Blocking a profile still prevents new admissions rather than disconnecting an
already established tunnel.

Local checks cover Go/race, PostgreSQL migrations and restricted roles, direct
and Server URL issuance, Debian arm64/amd64 package lifecycles, and Lambda builds.
Live AWS deployment and native OpenVPN Connect UI were not repeated for this patch.

Verification

Main Checks, CodeQL and pre-release Real Okta passed on the release commit. Real Okta covers SAML, encryption policy and legacy browser downloads; bound-profile owner labels, import handoff and restricted-role permissions are covered by synthetic integration tests.

Packages

Commit: 994b80d04d1ec5e04a519002ae34cb34fb009bfa. License: AGPL-3.0-only.

Verified native ARM64 and AMD64 builds from Checks for this signed tag. Both bundles use format 3.

Debian 13 packages for ARM64 and AMD64, a shared metapackage and native Debian source are included. Install verified matching packages with apt install ./supivpn*.deb; see DEPLOYMENT.md.

GitHub build provenance was verified for all binary archives, Debian assets and Corresponding Source, including the tag commit and Checks run attempt 1.

Database schema: 12; compatible VM schemas: 7, 8, 9, 10, 11, 12.
Isolated Lambda required schema: 12.

Corresponding Source accompanies the binaries. Verify SHA256SUMS.asc with the pinned SupiVPN release key, then verify the downloaded files against SHA256SUMS before use.

Assets 18
Loading